CVE-2026-123547: Security vulnerability

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenAM versions before 16.1.4 are affected when no relayStateUrlList is configured. In that configuration, RelayState is not checked.

What does an attacker need to exploit the vulnerability?

An attacker needs to craft a single sign-on link containing a malicious RelayState value. A user must follow that link for the redirect to send them from the trusted OpenAM origin to an external site.

What is the practical impact of exploitation?

The attacker can use the trusted OpenAM origin to redirect users to phishing sites. This can also bypass URL filters that rely on the initial trusted URL.

What configuration can reduce exposure if upgrading is not immediately possible?

Configure relayStateUrlList so that RelayState values are checked, rather than leaving the list unconfigured.

CVE-2026-123547: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact of exploitation?

What configuration can reduce exposure if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the practical impact of exploitation?

What configuration can reduce exposure if upgrading is not immediately possible?